Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 05:36
Static task
static1
Behavioral task
behavioral1
Sample
236c771c0b33bd7185ebcb25993b7fd0_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
236c771c0b33bd7185ebcb25993b7fd0_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
236c771c0b33bd7185ebcb25993b7fd0_JaffaCakes118.html
-
Size
67KB
-
MD5
236c771c0b33bd7185ebcb25993b7fd0
-
SHA1
62cbe0237732a1e8e67bcb69df006759e30d84ad
-
SHA256
816d863e7c259f3d208e5c109f61b041dd0182f7a4d3171958f66b54716650ee
-
SHA512
fd5a56c1ae456baf3b51f3c6fd6bf11b66094d0e1208a71a3c9989548d2a03be3457869dfed25a9e1c271c37968a7aca767bf54b4e3c6ca6036491e457ef6221
-
SSDEEP
768:JikgcMsSZ8tN99OIs/n7oTyfQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IjkK5nM:JsWLTePec0tbrga6cuNnzIjv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421308434" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE570ED1-0CFC-11EF-9BF3-52E878ACFAD8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000037e40fa105fd3cf593c975156774ac4c8e9235542a31e7d0997d8194c700abe4000000000e80000000020000200000006f390c2c0226fcc908402035fa3496ab003a4f10aa2e699d0aa10d27a2d3a55d20000000ed8cca5737f073b57d0ccc386941a790458e812e40276b5654c391556909eb38400000006582d2951e130aef6a3730be29f9bfc877ba298a64b56094a28f2b5a04be06c82d6e784f411a75809f978cb8f2bee583467b36927202b7800e437c6e294d594e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a4a4003755d8fcb183b7ac921a1ae753b1d6264c67743b38f0bdc8e6ee5a7941000000000e80000000020000200000003e0b9bdc41a339b3386dc0681eba7f64a094933478b0ddd2e5f5c661c1a1a5d790000000da6a8a2e1587cd64b59b861601d73f7474cc1bdcbd9c0c4c121fbca6768f3fad558daf8e15685d0af5ac0c4f09ae08c0b6b0e76321902bd8ac4d772e865440e6664c66cfe48c8fe6b062488eafe09443c6ce7f1e1254ed776ca42b61142bb079abed8d35e58a823f8b30e58e798f741b6d7e486d840babb74644c2075dee8e1b868bbd0f30f93e034c66beb3bc194c97400000001154fdb646b0a276f6fcad27e190a36f041a2b9d8ab87cff58464e764efb3369e7e391ed8f8ac28fa7609cb09770a982c4b4c32076b9df9bfe1d896c0eb588ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308efdb209a1da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE 2120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2120 2220 iexplore.exe 28 PID 2220 wrote to memory of 2120 2220 iexplore.exe 28 PID 2220 wrote to memory of 2120 2220 iexplore.exe 28 PID 2220 wrote to memory of 2120 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\236c771c0b33bd7185ebcb25993b7fd0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5076a81eb2b54b5d557bcd0d2143f055f
SHA14031c29c47fe634dd2ce8a971b0110835667f6bd
SHA256299bcebcb911ab66a8445cb8d55196139ef3c688c692acc927428d6e00118387
SHA512fff741719553aee0d025f66016c89e0bffff835279fa2de43121dda52022cf4e599385c9cdb35efc908a9406e40646465f5498a2a2a5a7a10a1a70178525f80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f29020548d842c5b4c319abf6000fa5d
SHA15fb7fa4df9663dc92f3a0e04e38c1f5c7af32a11
SHA2567917f102955a75118345ed433034d94bfe90d19d0879dfb211eb511565c47428
SHA512c5ee178e722f7f6aee8d8a04782a5aa225cfeb93ecf129677cc859a70d1c7941b79c3a24748a69282cf69132a24d7b8186b2b91f03345c1df7e18ccafc531f85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aac08ceaed088047a7312da2c42eeb05
SHA19ca4fc6179b8803812da905120a52f32504ff7f2
SHA256d74483548d7a2c31a73b1a180fe8366c4121c4c5a68bc7508fdb19af5294f7dd
SHA5122937c05e9722219319ceee50e83bb2dbef2a9158ace30d0f190da0846c51a3240db934e6c8b48795fdf11dc9e6beaaf0efe971c385b5c5d80e6bbe14a2ba6293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd6065fd5d4c85a8392235c6027f46ea
SHA18e28e2755ca96738ae9ad2e45829fe3d615bb461
SHA2568c66005ab2ac021b0f063ee718523aebad46c5e496614a51955f43dd77dcf237
SHA512e383b922a080691e7daa5069d1623757d6633a5ad6cf8cd4818ce97cd3ff8ff795812dfd6c7d2139b87d22db94425c4691b598fe6d492e9b2aa2e9524cba767b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df2e471c6045e5da9adfb08110fc727b
SHA182f55247ce0fbb7a148825bb57aede3cd69df4a2
SHA256b221930ac64a931475775a077c5e70dc67659d8e7994f7ef4c7ff14abbe11fb0
SHA512f66765418772cdd265b27213064cbd5f25ff37f8599fde3c06b67bdf68688618e6964e800aad1da30dfa39e12abeaed9ca21d8a995cc7bfe50a3cc04c6382794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50250d795d8a3f23a0379c278c404bb36
SHA19338b3e1315ea928e6f55031c1d7819713f93043
SHA256846301267b000c3dca6f443895276e893155766522a931444744f185d9623e1b
SHA512744080eec56f1efc180d857cc894a87933b71816d142f8f97c0b0a60172ff8cd77c840b4543fe592c2324b6c39ed6ac1f30d2733e50c2ba0333ed3e1c357d1f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8416a39875674b812586e3cd3f09e63
SHA189fcdc82cfedd6b707d3d0f0b330be1b41f477dd
SHA256991d9abe29f260851a8e49f3a5696ed957d8bae5132374133f48fc4af4322d0e
SHA512e5b740f14e0742c356c18c84f49e1b8f2f650a644c559797f6805e8febe1c9f6b991835a24ed9edbd8b10a72ea035d75e0b3e66d5f2e789ab65f15d8ceb0f1cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53709db73caf306b2e9a60ea583c02a94
SHA1e95ba7a845623faa473fd2b619a854cf86c28128
SHA2567089f23d4ec5e9d47b992ca0e881dbf74c8489021c956b45972fb324070abc4c
SHA51252f14493cd50b6cc346ccc2e89c7977a31a4e43ed6aead92f35579aa80455ada80d8d4ac3b56b0e884ed0ecec6dc24795994ff85e54ee9fcc8563de40edfa111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e479dbcabfc095505973f07cd60cdfee
SHA1bd90999779845681440f755e4c484686641c972b
SHA25639b987747b1d2d92ba5ba43febfdc9a8c8ece1deba2854ea496ee41993f80237
SHA51232e110f82d2f253f9118604158fcf71eafc634b5a8130c4acad84bd5e766431c97b7d6f444e1aeb0d054c22710e6299caf6a77e2097a0105b7d06de5eca5620e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baa5372e0918fdf23a0ec34813a23135
SHA13559b8473f83d93a1776a88e6c490db59a3a184d
SHA25602b573df9910415aa70c2338db975e3cfa80f416938e29bbb3777aaf2a6bdf03
SHA512ca3ddb7cb137d867831cfd11b10bc5d7d9e8adbc59f72a5941ca528e5f579370ae7f2eb236fc3ff10b3fccb6cab0e6e76ddc855b09a4bfd0a9512135349c63cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5778693bee65ead766f8a8c181e3bba7b
SHA177188db8af4c951851dee023aee821e685c063d3
SHA2567a00d62ea1fe3b5bf340722c7edc3e6d9030d1fe460e14f32d569213d8169658
SHA512b4842e46058e6d1c846abee224247117fc69a54e6b17d80cb391e64ed6786d97545a6915b37b0d0a091a9709a1d5d5a9c45b22f770f3e28fc62b4c616666e46a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2f2a1cbdd3dd1fa1495cd7fa23831a7
SHA1b1f29b61d8348c30c40a1e3b67c00868c3d9162a
SHA256a37afe4d556597120e870e947943559fd1970494b78591790b83788b841201a8
SHA5121c70d779bb51d3dc7b6ddf54a7454d610f39e19a42e6b472c4103fb79623388aaaaef718997c5bcfd919b7a62f613531e1efe913acc8d8361eaa2358f9c035ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b8200f9e67535e8509ec0d10a5b15b2
SHA15cdf8b8ca67f090dc8b8e3f62d170965da54d964
SHA2565ab724b70b5ac81d80102cb6179feb90aadfc4d0e0b4ded57c680c69b055d3d5
SHA512c166bacf28c4ca7810ecad430a98d55bf7199fa46e9a3799c08e93e8fad9eeed7e99b647dcb0267a2846bdbdd7cd12b0b1705f0e1585c6da6101f246cf2a9a01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db2d46b266830a087d2b6d571d5b6dab
SHA198544bb3528a95e6f12c84a38c54b2a8a3e49386
SHA256f9f8b8d819451f5cc624cd78115957003ee1e379083fc2625917b677d3c0e530
SHA512699b3680bc1ac4aa8e2ab79ca61c89c9e60757c17fe42035817bf98d6d72850401be366815b24c0aade4d25386cfc86d5ab32b646a42de9f4c77a3a21bc37307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1aeef7966f02c2b6102c14ef6ba6015
SHA184f9265556369e9bc82ff98eb85b687c8e894f90
SHA2566778c733921e70cb8d393693a5c8f8231b5c500a8ff4c9ad43dde1cf4e049bb0
SHA512af53b758d1896c2674e726000e472b2116b3da56f550d08d02a3dd3a2a6342dd104273c0b71aa00ef0ab0e051a4174e3aa648450ff9094022c25f5a2357f6b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2302abbfc0155cc36b1bb210f2aaa78
SHA149fd9e778a157cea515bb34aa474dfd5e7afb90c
SHA256991cbf051f24d5007ddd9d63966e38e562b1548445413dbe96b09c3f703dd6f2
SHA512e719b742ec3de9560b91626d61bf3bd23243dc53c8665ecf02abdc6262b9e5f584c93bf814590966bd69c438d69449930d11473f27de096aaa6c2ad3d2e569dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de5fe1f61b168e16b1095ccca9cd82dc
SHA1716da7f74e62dc461aac0f2ad5575cbcb20c8e1a
SHA256b5ca3601c4c4b2da19b621214ebc2d4890502816e263e20bf83c462f05271d1d
SHA51209c1356ca0e1652ee89c0d5ccc5f987e28f65f0d739dc65f83d940524adff0b801571e377921eb9590887bf04f2c9d5e84b3ac45c23e8067fe696f969a625538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3b22d1af57fea64bc326d9749941aab
SHA13e06543a9adcac96edf3b417c5954a383cdbfbfb
SHA256af608622f5e1faaebd5806766d057569a9078d8f717c7f07c77e5ad634281966
SHA512b37aa6d34b49e25c200af7fde8e53294201f08069112d9695c435538142c1e4622f86c8f24bbf4fda710213b6f045b609f3f1efa94e8f192054516d1e9e7300b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e41962940b6943566e67cdca452f9a07
SHA1ab20df1bd76c8867420634b9687c977ff9a5fa98
SHA256dcea0b43d3093d0fd15698a782f2fb4898c50971cc685a47041dd486612a0619
SHA5126d6e4c80afb3ba020fe89558143adca030c2767ee5870e1c48f3d9c8b607a19ef5bf34e5f4f1b52625628d77758571bd69528504f97e45c237fb70df55db938f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a